[feat](trx-frontend-http): add restricted Guest role

Assisted-By: Codex (GPT-5)
Signed-off-by: Stan Grams <sjg@haxx.space>

docs/Architecture.md

@@ -926,7 +926,8 @@ main
 ### HTTP Frontend Auth
 
 - Optional Argon2id-backed managed accounts with HttpOnly session cookies
-- Composable Read, Control, Write, and Administrator roles, with policy shared by middleware and handlers
+- An exclusive Guest role plus composable Read, Control, Write, and Administrator roles, with policy shared by middleware and handlers
+- Guest sessions receive read-only station access but no account-control endpoints or panels
 - Atomic JSON persistence with migration from the legacy single-role schema
 - Account enable/disable, administrator CRUD, self-service password changes, and session revocation on security changes
 - A database invariant always preserves at least one enabled administrator

docs/UX_Guidelines.md

@@ -126,7 +126,8 @@ When auth is enabled, an **auth gate** blocks the UI with:
 - Error message area (red `#ff6b6b`)
 - Role badge display
 
-Accounts may combine **Read**, **Control**, **Write**, and **Administrator** roles.
+**Guest** provides read-only station access and is exclusive. Non-Guest accounts
+may combine **Read**, **Control**, **Write**, and **Administrator** roles.
 Administrator implies all permissions.
 
 Session cookie: `trx_http_sid`, HttpOnly, configurable Secure and SameSite attributes.
@@ -341,7 +342,7 @@ Routes are classified into three tiers:
 | Tier | Examples | Requirement |
 |---|---|---|
 | **Public** | `/`, `/index.html`, `/map`, login/session endpoints, static assets | None |
-| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Read, Control, or Administrator role |
+| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Guest, Read, Control, or Administrator role |
 | **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, radio-control POST routes | Control or Administrator role |
 | **Write** | Logbook access and bookmark mutations | Write or Administrator role |
 
@@ -354,8 +355,9 @@ Routes are classified into three tiers:
 
 ### 7.3 User Management
 
-Every authenticated account gets a Settings > Account tab for changing its own
-password. Only administrators get Settings > Users, where accounts can be
+Every authenticated non-Guest account gets a Settings > Account tab for changing
+its own password. Guest sees neither Account nor Users and both account-control
+APIs deny Guest sessions. Only administrators get Settings > Users, where accounts can be
 created, enabled/disabled, assigned multiple roles, given a new password, or
 removed. The final enabled administrator cannot be disabled, removed, or
 demoted. Account security changes revoke every active session for that account.

docs/User-Manual.md

@@ -354,9 +354,9 @@ A name in any of those maps that no remote answers to is a config error.
 | `bootstrap_admin_username` | string | — | First administrator, used only if the database is absent |
 | `bootstrap_admin_password` | string | — | First administrator password |
 | `bootstrap_admin_password_file` | string | — | Read the bootstrap password from this file instead |
-| `bootstrap_read_enabled` | bool | `true` | Create the default read-only account when the database is absent |
-| `bootstrap_read_username` | string | `"guest"` | Initial read-only username |
-| `bootstrap_read_password` | string | `"guest"` | Initial read-only password |
+| `bootstrap_read_enabled` | bool | `true` | Create the default Guest account when the database is absent |
+| `bootstrap_read_username` | string | `"guest"` | Initial Guest username |
+| `bootstrap_read_password` | string | `"guest"` | Initial Guest password |
 | `session_ttl_min` | u64 | `480` | Session lifetime |
 | `cookie_secure` | bool | `false` | Set Secure on the session cookie (needs HTTPS) |
 | `cookie_same_site` | string | `"Lax"` | `Strict`, `Lax`, or `None` |
@@ -589,9 +589,9 @@ left as it was, rather than publishing a frequency the rig is not on.
 
 ## Authentication
 
-The HTTP frontend supports an optional user/password ACL with multiple independent
-roles. One account may have any combination:
+The HTTP frontend supports an optional user/password ACL:
 
+- **Guest** — read-only station access with no Account or Users controls; Guest cannot be combined with another role
 - **Read** — monitoring, audio, decode streams, and bookmark reads
 - **Control** — full radio receive/transmit controls
 - **Write** — logbook access and bookmark changes
@@ -615,7 +615,7 @@ cookie_same_site = "Lax"   # Strict|Lax|None
 
 When `enabled = false` (the default), all auth is bypassed and the UI behaves
 as before. When enabling it for the first time, bootstrap credentials create
-the initial administrator (with every role), the default `guest`/`guest` Read
+the initial administrator (with every non-Guest role), the default `guest`/`guest` Guest
 account, and the Argon2id-hashed user database. Change or disable the guest
 credentials in configuration before first startup on an exposed deployment.
 
@@ -625,8 +625,9 @@ credentials in configuration before first startup on an exposed deployment.
 - Sessions are in-memory; a server restart invalidates all sessions.
 - Rate limiting is applied per IP to mitigate brute-force attempts.
 - User records persist in `users_file`; passwords are stored as salted Argon2id hashes.
-- Roles are independent; for example, an account may have Read and Write without Control.
-- Every signed-in user can change their own password in Settings > Account. This signs out all of their sessions.
+- Non-Guest roles are independent; for example, an account may have Read and Write without Control.
+- Guest accounts have no account-control panels and cannot call account-control endpoints.
+- Every non-Guest signed-in user can change their own password in Settings > Account. This signs out all of their sessions.
 - Administrators can add, enable/disable, or remove users and change roles/passwords in Settings > Users.
 - At least one enabled administrator must always remain and cannot be disabled, removed, or demoted.
 - Disabling/removing an account or changing its password/roles revokes all of its sessions.
@@ -639,11 +640,11 @@ credentials in configuration before first startup on an exposed deployment.
 | `/auth/login` | POST | Submit `{ "username": "...", "password": "..." }` |
 | `/auth/logout` | POST | Clear session |
 | `/auth/session` | GET | Check current session/roles |
-| `/auth/account/password` | PATCH | Change the signed-in user's password after verifying the current password |
+| `/auth/account/password` | PATCH | Change a non-Guest user's password after verifying the current password |
 | `/auth/users` | GET/POST | List or add users (admin only) |
 | `/auth/users/{username}` | PATCH/DELETE | Change enabled state/password/roles or remove user (administrator only) |
 
-Read routes require Read. Radio mutations require Control. Logbook access and
+Read routes accept Guest or require Read. Radio mutations require Control. Logbook access and
 bookmark mutations require Write. Administrator grants every permission.
 
 ### Frontend Flow